3

If you can avoid it, most people will not use file: URIs because there are just so many quirky rules about what is and isn't allowed, but sometimes it's not up to you, you just have to support loading a HTML file or app from a file: URI.

For those times, is there any comprehensive and up-to-date documentation or guide for what browsers do and don't allow for file: URIs? There is information out there, but it is piecemeal. This question for example explains that you can't load an ES module over a file: URI in Chrome, but you can in Firefox. But what about fetch(), WASM, or other modern web technologies? Maybe they don't work over file:, but do support data:, if you can construct one with the right MIME type?

It would be very useful for those rare times when you just have to support running a web app from a local file: URI, if there was a guide that laid out what works consistently across all browsers, so that if you stick with those few technologies your app will work. Does anyone know of anything like that? I've tried searching the web and MDN, but haven't found anything, but that could be because it seems like most search engines ignore the colon in file:.

curiousdannii
  • 1,658
  • 1
  • 25
  • 40
  • my advice is, `file:///` scheme is useful for static pages, maybe with a little javascript, but certainly no AJAX - anything else, don't use it – Jaromanda X May 22 '20 at 05:41
  • You can do quite a lot with it, especially if you can include everything inline in the html file itself. Things break down if you have to refer to other files. You can load any JS file, reference CSS and images (but not get their actual contents as a blob), but many newer things seem to require proper MIME types. Maybe `file:` traps you with the web technologies of a decade ago, but it would be good to have confirmed what if anything from after then can be reliably used. – curiousdannii May 22 '20 at 05:44

1 Answers1

2

Here I found an interesting article. They basicaly said:

Chromium allows HTML pages served from file:// URIs to load images and scripts from the same path, but Legacy Edge (v18) and Internet Explorer are the only browsers that consider all local-PC file:// URIs to be same-origin, allowing such pages to refer to other HTML resources on the local computer. Other browsers treat file origins as unique, blocking DOM interactions between frames from different local files, etc.

Based on this whatwg1 or whatwg2 or w3:

it is UA-specific "is left as an exercise to the reader"

For Chrome:

file:// schemed URIs do not contain a host component; be sure that your UI accounts for this possibility.

For Mozilla:

file: Host-specific file names

So basically, it is a mess as they have to face security issues.

Other resources:

MaxiGui
  • 6,190
  • 4
  • 16
  • 33